Thank you for being a valued part of the CNET community. As of December 1, 2020, the forums are in read-only format. In early 2021, CNET Forums will no longer be available. We are grateful for the participation and advice you have provided to one another over the years.

Thanks,

CNET Support

General discussion

RPCSS delays windows XP booting

May 19, 2005 4:48PM PDT

I am running windows-xp-he OS. I have just had to reinstall xp. When windows boots, I get the message ''RPCSS is starting''. This delays my boot 15-20 seconds. I never got this with my original xp installation. What has happened and how do I get rid of it? Doesn't seem to be important since I ran three years without it.

Thanks,
Ray Savage

Discussion is locked

- Collapse -
This info from
May 19, 2005 8:45PM PDT
http://www.answersthatwork.com/Tasklist_pages/tasklist_r.htm

"Remote Procedure Call Services ? it is RPCSS.EXE in Windows 95/98/ME, while it is RPCSS.DLL in Windows NT4/2000/XP/2003. Remote Procedure Call is the feature which enables programs to call each other?s publicly declared procedures (programming code) over a network. From initially being little used under Windows 95/98/ME, RPCSS has now become essential to the proper running of most of the recent versions of network related Microsoft software (Winsocks, Internet Explorer, ICS), thus disabling it or deleting it will result in problems at some point. Under any Windows 95/98/ME environment with reasonably recent Microsoft software installed, RPCSS runs at all times as a transparent task visible only through The Ultimate Troubleshooter, while under Windows NT4/2000/XP/2003 RPCSS is a crucial part of the design of the operating system and deleting/disabling this program disables the operating system !

Recommendation :
Leave well alone !"

I'm not sure why it would be creating a warning message on bootup, or slowing your startup down, but it seems it is necessary. Make sure the Remote Procedure Call (RPC) in Services.msc is set to automatic. (Start > Run type in services.msc).

Mark
- Collapse -
RPCSS
May 20, 2005 11:43AM PDT

Mark:

Thanks for your reply. I was mistaken about the delay - I timed from the appearance of ''Starting RPCSS'' until the ''Welcome Screen'' (appears just before the Desk Top shows) - it was not 15-20 seconds, but closer to one minute. My question is why did I not get this for the three years of the original installation of XP? My computer ran great and total boot time was just about a minute! I used the same XP installation CD for my reinstallation that I used three years ago.

I checked the Services and the RCP is set on automatic and is running. Any other suggestions to get my boot time back to normal would be appreciated. Now I feel like I've reverted back to win-me.

Best regards,
Ray

- Collapse -
RPCSS
May 20, 2005 10:16PM PDT

Hi Ray,

Other than what Cursocowboy suggested, I'm stumped as well. I hadn't thought about the msblast worm, but it seems it is not that anyway.

Have you checked the Event viewer?

Start > Control Panel, double click Administrative Tools, and in the list, open up the EVent Viewer.

Look for any Errors or Warnings in the right hand window when you highlight Application or System, preferably for times on or just after the time you turned on the computer.

If you find any, highlight, and right click, and select Properties, see if there are any clues there.

Other than that, I don't have any other ideas at the moment.

Good luck,

Mark

- Collapse -
RE:
May 19, 2005 10:20PM PDT

1. If your computer is infected with this worm, you may not experience any symptoms, or you may experience any of the following symptoms, [Q826955]:

? The Remote Procedure Call (RPC) service terminated unexpectedly.

? The computer may shut down, or may restart repeatedly, at random intervals.

? On a Windows XP-based or on a Windows Server 2003-based computer, a dialog box may appear that gives you the option to report the problem to Microsoft.

? If you are using Windows 2000 or Windows NT, you may receive a Stop error message.

? You may find a file that is named Msblast.exe, Nstask32.exe, *****32.exe, Teekids.exe, Winlogin.exe, Win32sockdrv.dll, or Yuetyutr.dll in the Windows\System32 folder.

? You may find unusual TFTP* files on your computer.

2. Symantec's Blaster.Worm Removal Tool - http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

3. Supplemental reading: ''[Computer viruses: description, prevention, and recovery (Q129972).''

Caveat: Download the patch described in the Microsoft article, ''MS03-039: A Buffer Overrun in RPCSS Could Allow an Attacker to Run Malicious Programs (Q824146)'' (a 1,508Kb file) for the applicable version of WinXP used and keep it on hand and install before ever accessing the Internet for Updates with IE. Should you format and reinstall XP original at a later date, then install it first unless the version used already has been patched through or includes the SP2.

- Collapse -
Rpcss Delays
May 20, 2005 12:15PM PDT

Cowboy:
Thanks for your reply. I checked the references but find no indication of a Worm infection. I still can't figure why I ran xp for 3 years without seeing any reference to RPCSS starting in my boot up and expenencing such long boot times?? I timed the loading from ''RPCSS is Starting'' till the Welcome Screen (just befor desk top appears) - it alone was almost one minute instead of the 15-20 seconds I estimated originally. That was what my total boot time used to be (it now is close to 2 minutes total). All unnecessary startup programs have been removed from start up menu. Any other suggestions will be appreciated.

Best regards,
Ray

- Collapse -
RE:
May 20, 2005 10:52PM PDT

Strange and I'm not seeing anything other than that this has now started from a relatively new system a few years ago to a few years later and the install may have picked up on something that has now changed - even to the point that a load sequence is now different from what it was in yesteryears. Two things you might try with to see if something else comes out in the wash:

FIRST:

1. The "command-line" tool (Tasklist.exe) run with the wanted "Syntax" allows you to obtain a list of active processes that are running. For each process, it displays the process name and process identifier (PID). For more information about the Task List or the related Task Kill and Process Viewer tools, click Tools in Help and Support Center.

2. In addition, "A Description of Svchost.exe in Windows XP (Q314056)."

Note: The article [Q314056] explains that at startup, Svchost.exe checks the services part of the registry to construct a list of services that it must load. Multiple instances of Svchost.exe can run at the same time. Each Svchost.exe session can contain a grouping of services. Therefore, separate services can run, depending on how and where Svchost.exe is started. This grouping of services permits better control and easier debugging.

3. When you start Windows, dozens of programs are already running - many of them invisible and running in the background. "AutoStart Viewer" allows you to see every autostart on your system, all on the one screen. In addition, it gives you complete control over the autostart references, and allows you to modify or delete them at will. Key features are:

? Over 50 different autostart locations monitored!

? Right-click menu allows you to take complete control over each autostart

? Add New Autostart feature allows you to add new programs to automatically start

? Save/Print functions allow you to take snapshots

? Resizable, easy-to-use interface that shows every autostart on the one display

? All sizes, positions and settings are remembered

SECOND:

Use the NTBTLOG.TXT file to potentially identify startup problems.

a. "Enable Boot Logging" to creates a text log file in the systemroot directory with this name and can be double-clicked for viewing. The log lists files that Windows attempts to load and precedes the path of each by identifying them as Loaded driver or Did not load driver. Restart the computer, and when prompted, press F8, and then select Enable Boot Logging on the Windows Advanced Options Menu. Else, the articles [Q833721] and [Q323427] discusses the procedure for editing the Boot.ini file to enable boot logging.

Note: If a critical system file is corrupted or missing, Windows might generate a STOP message or write an entry to the "Event logs" or both, which you may not even be aware of.

b. To check an item listed in the Did not load driver section:

? Check for zero byte files or files with date and time stamps that do not match the Windows installation date.

? Compare files in systemroot\System32 to the same files on the Windows CD or another computer running the same edition (and service pack(s)).

? Run the System File Checker (Sfc.exe) command-line tool to inspect system files, [Q310747].

- Collapse -
RE:
May 24, 2005 1:44PM PDT

Cowboy:

Just noted something unusual in my Boot.ini (sysconfig):
multi(0)disk(0)rdisk(0)partition(1)="Microsoft Windows XP Home Edition" /fastdetect/Noexecute=optin.
The "Noexecute=optin" switch was not in my original Boot.ini. I thought that I would try to delete this switch to see what would happen, but I couldn't delete it. Could this be my problem? How did it get there? How do I remove it?

Thanks,
Ray

- Collapse -
Simplest
May 24, 2005 1:57PM PDT

Control Panel>System>Advanced>Start up and Recovery>Settings>Edit

- Collapse -
Re: Simplest
May 24, 2005 3:32PM PDT

Paul:

Thanks for your reply and help!

Best regards,
Ray

- Collapse -
Problem Solved!
May 26, 2005 1:49PM PDT

I installed XP-SP2 and the problem was solved - Boot time MUCH shorter! Thanks for all your help and input regarding this problem!

Best regards,
Ray